docs: def load_windowstime(buf, pos):
      """Load LE64 windows timestamp"""
      # unix epoch (1970) in seconds from windows epoch (1601)
      unix_epoch = 11644473600
      val1, pos = load_le32(buf, pos)
      val2, pos = load_le32(buf, pos)
      secs, n1secs = divmod((val2 << 32) | val1, 10000000)
      dt = datetime.fromtimestamp(secs - unix_epoch, UTC)
      dt = dt.replace(microsecond=n1secs // 10)
      return dt, pos